CVE-2026-31619: ALSA: fireworks: bound device-supplied status before string array lookup
ALSA: fireworks: bound device-supplied status before string array lookup
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.137.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
Which systems are exposed?
Systems using the Linux kernel ALSA Fireworks driver are relevant, because the vulnerable status value is supplied by a FireWire device. The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.134.1-2.
What is the impact of a malicious status value?
An out-of-range 32-bit status value can be used as an index into a 17-entry status-name array during string lookup. This can lead to availability impact, reflected by the CVSS availability impact of High; confidentiality and integrity impacts are listed as None.
How is the issue fixed?
The available patch bounds the device-supplied status value against the status-name array size. Unrecognized values are reported as "unknown" instead of being used for the array lookup.